22369 matches found
ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link
Cybersecurity researchers have disclosed a critical vulnerability in OpenAI's ChatGPT Workspace Agents that could have allowed a single phishing link to stealthily build, authorize, and deploy an autonomous artificial intelligence AI agent inside a victim's organization. The vulnerability has bee...
Email Subscribers & Newsletters <= 5.3.1 - Authenticated SQL Injection
The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the order and orderby parameters to the ajaxfetchreportlist action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscriber. Further, it does not have any CSRF protecti...
Ozette Plugins - Cross-Site Request Forgery
An attacker can update, create, and remove the site's mobile redirects via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. id: CVE-2023-23897 info: name: Ozette Plugins - Cross-Site Request Forgery author: popcorn94 severity: medi...
CVE-2026-15212
The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the AjaxService::verifyajaxrequest helper gating its wpverifynonce call behind the boolean option 'enablenoncecheck', which is absent from the default...
CVE-2026-15212
CVE-2026-15212 affects the WPO365 | Login plugin for WordPress (up to version 43.2). The root cause is that Ajax_Service::verify_ajax_request() gates wp_verify_nonce() behind the boolean option enable_nonce_check, which is missing from the default wpo365_options. This causes wp_ajax_wpo365_update...
EUVD-2026-48382
The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the AjaxService::verifyajaxrequest helper gating its wpverifynonce call behind the boolean option 'enablenoncecheck', which is absent from the default...
CVE-2026-15212
The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the AjaxService::verifyajaxrequest helper gating its wpverifynonce call behind the boolean option 'enablenoncecheck', which is absent from the default...
CVE-2026-15212 WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 43.2 - Cross-Site Request Forgery to Privilege Escalation via Plugin Settings Update
The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the AjaxService::verifyajaxrequest helper gating its wpverifynonce call behind the boolean option 'enablenoncecheck', which is absent from the default...
EUVD-2026-48248
Cross-Site Request Forgery CSRF vulnerability in MailPoet allows Cross Site Request Forgery. This issue affects MailPoet: from 5.30.0 through 5.33.0...
EUVD-2026-48141
Unauthenticated Cross Site Request Forgery CSRF in Popup for CF7 with Sweet Alert = 1.6.5 versions...
EUVD-2026-48140
Unauthenticated Cross Site Request Forgery CSRF in Kwayy HTML Sitemap = 4.0 versions...
CVE-2026-65540
CVE-2026-65540 affects the WordPress plugin “Popup for CF7 with Sweet Alert” (versions <= 1.6.5). The vulnerability is a reported unauthenticated Cross Site Request Forgery (CSRF) weakness in this plugin. The CVSS data indicate: AV:N, AC:L, PR:N, UI:R, S:C, C:L, I:L, A:L, base score 7.1 (HIGH)...
EUVD-2026-48118
Unauthenticated Cross Site Request Forgery CSRF in WP Activity Log = 5.6.4 versions...
CVE-2026-65471
The CVE-2026-65471 entry concerns unauthenticated Cross Site Request Forgery (CSRF) in the WordPress Avada Core plugin
EUVD-2026-48083
Unauthenticated Cross Site Request Forgery CSRF in Avada Core = 5.15.6 versions...
CVE-2026-65464
The CVE-2026-65464 entry describes an unauthenticated Cross Site Request Forgery (CSRF) vulnerability in the WordPress GiveWP plugin, affecting versions up to 4.16.3. The available documents identify the vulnerability as CSRF but do not provide details on the affected files/components, root cause...
EUVD-2026-48076
Unauthenticated Cross Site Request Forgery CSRF in GiveWP = 4.16.3 versions...
EUVD-2026-48224
Unauthenticated Cross Site Request Forgery CSRF in Zarinpal Gateway = 5.1.0 versions...
CVE-2026-65460
CVE-2026-65460 affects the WordPress Zarinpal Gateway plugin (≤ 5.1.0). The issue is an unauthenticated Cross Site Request Forgery (CSRF) vulnerability in versions ≤ 5.1.0. Attack context: network access required, with user interaction necessary for exploitation; impact details are not expanded b...